Elastic Block Store
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for Elastic Block Store rules that match the service but not a specific eventName. | N | N |
| Complete | Seals and completes the snapshot after all of the required blocks of data have been written to it. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
| Get | Returns the data in a block in an Amazon Elastic Block Store snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | Returns information about the blocks that are different between two Amazon Elastic Block Store snapshots of the same volume/snapshot lineage. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| List | Returns information about the blocks in an Amazon Elastic Block Store snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Put | Writes a block of data to a snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet. | N | N |
| Start | Creates a new Amazon EBS snapshot. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record. | N | N |
any: Elastic Block Store (catch-all)
#Description
Catch-all entry for Elastic Block Store rules that match the service but not a specific eventName.
CompleteSnapshot
#Description
Seals and completes the snapshot after all of the required blocks of data have been written to it. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "91da4c22-cf93-4176-bc31-ed0c594ce1c7",
"eventSource": "ebs.amazonaws.com",
"eventName": "CompleteSnapshot",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "da58baf2-94a8-4273-907c-70167bec2e60",
"userAgent": "aws-sdk-go-v2/1.42.1 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#amd64 api/ebs#1.28.7 m/0,E",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}
GetSnapshotBlock
#Description
Returns the data in a block in an Amazon Elastic Block Store snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListChangedBlocks
#Description
Returns information about the blocks that are different between two Amazon Elastic Block Store snapshots of the same volume/snapshot lineage. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
ListSnapshotBlocks
#Description
Returns information about the blocks in an Amazon Elastic Block Store snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
PutSnapshotBlock
#Description
Writes a block of data to a snapshot. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.
StartSnapshot
#Description
Creates a new Amazon EBS snapshot. Operation catalog is model-derived from the AWS SDK (botocore); this (eventSource, eventName) pair is confirmed by an observed CloudTrail record.
Example CloudTrail Event #
This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.
{
"eventVersion": "1.11",
"eventID": "60d9668c-559c-44ac-897d-f7a64d81c15f",
"eventSource": "ebs.amazonaws.com",
"eventName": "StartSnapshot",
"awsRegion": "us-east-1",
"eventType": "AwsApiCall",
"readOnly": false,
"managementEvent": true,
"requestID": "cd0456f8-4cfb-42bf-8d29-b5800e899863",
"userAgent": "aws-sdk-go-v2/1.42.1 ua/2.1 os/linux lang/go#1.26.5 md/GOOS#linux md/GOARCH#amd64 api/ebs#1.28.7 m/0,E",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
}
}